FastStone Image Viewer v.<= 7.5 is affected by a Stack-based Buffer Overflow at 0x005BDF49, affecting the CUR file parsing functionality (BITMAPINFOHEADER Structure, 'BitCount' file format field), that will end up corrupting the Structure Exception Handler (SEH). Attackers could exploit this issue to achieve code execution when a user opens or views a malformed/specially crafted CUR file.
References
| Link | Resource |
|---|---|
| https://voidsec.com/advisories/cve-2021-26236-faststone-image-viewer-v-7-5-stack-based-buffer-overflow/ | Exploit Third Party Advisory |
| https://voidsec.com/fuzzing-faststone-image-viewer-cve-2021-26236 | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/49660 | Exploit Third Party Advisory VDB Entry |
Configurations
History
24 Mar 2021, 01:19
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-787 | |
| CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 7.8 |
| References | (MISC) https://voidsec.com/fuzzing-faststone-image-viewer-cve-2021-26236 - Exploit, Third Party Advisory | |
| References | (MISC) https://www.exploit-db.com/exploits/49660 - Exploit, Third Party Advisory, VDB Entry | |
| References | (MISC) https://voidsec.com/advisories/cve-2021-26236-faststone-image-viewer-v-7-5-stack-based-buffer-overflow/ - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:faststone:image_viewer:*:*:*:*:*:*:*:* |
18 Mar 2021, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Mar 2021, 14:02
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-03-18 13:15
Updated : 2023-12-10 13:41
NVD link : CVE-2021-26236
Mitre link : CVE-2021-26236
CVE.ORG link : CVE-2021-26236
JSON object : View
Products Affected
faststone
- image_viewer
CWE
CWE-787
Out-of-bounds Write